HTB Academy - nmap scanning basics
HTB Academy - nmap scanning basics: Nmap Enumeration & Vulnerability Assessment The objective was divided into two tasks: 1. Find all TCP ports on your target. Submit the total number of found TCP ports as the answer. 2. Enumerate the hostname of your target and submit it as the answer (case-sensitive). --- ## Explanation of Flags... • PortSwigger • nmap
Nmap Enumeration & Vulnerability Assessment
The objective was divided into two tasks:
- Find all TCP ports on your target. Submit the total number of found TCP ports as the answer.
nmap -v -A 10.129.255.146- Enumerate the hostname of your target and submit it as the answer (case-sensitive).
nmap -v -A 10.129.255.146Explanation of Flags
-v: increases verbosity. Shows open ports as they are found and adds completion time estimates.-A: enables OS detection, version detection, script scanning, and traceroute.
Updated Scan
A better scan would be:
nmap -sV -sC -p- 10.129.42.253Example output:
Starting Nmap 7.80 ( https://nmap.org ) at 2021-02-25 16:18 EST
Nmap scan report for 10.129.42.253
Host is up (0.11s latency).
Not shown: 65530 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x 2 ftp ftp 4096 Feb 25 19:25 pub
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
139/tcp open netbios-ssn Samba smbd 4.6.2
445/tcp open netbios-ssn Samba smbd 4.6.2
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_nbstat: NetBIOS name: GS-SVCSCANExplanation
-sC: run Nmap default scripts-sV: service version detection-p-: scan all 65,535 TCP ports
Nmap Scripts (NSE)
Scripts can be located with:
locate scripts/citrixRun them with:
nmap --script <script-name> -p <port> <host>Output Options
- Normal:
-oN target.nmap - Grepable:
-oG target.gnmap - XML:
-oX target.xml
Convert XML to HTML:
xsltproc target.xml -o target.htmlNSE Examples
Default Scripts
sudo nmap <target> -sCScript Category
sudo nmap <target> --script <category>Defined Scripts
sudo nmap <target> --script <script1>,<script2>Example: SMTP Enumeration
sudo nmap 10.129.2.28 -p 25 --script banner,smtp-commandsOutput:
PORT STATE SERVICE
25/tcp open smtp
|_banner: 220 inlane ESMTP Postfix (Ubuntu)
|_smtp-commands: PIPELINING, SIZE, VRFY, STARTTLS, 8BITMIMEThis shows the SMTP server is Postfix on Ubuntu and supports VRFY.
Aggressive Scan
sudo nmap 10.129.2.28 -p 80 -AOutput:
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-title: blog.inlanefreight.com
|_http-generator: WordPress 5.3.4This reveals the server software and CMS version.
Vulnerability Assessment
Using the vuln category:
sudo nmap 10.129.2.28 -p 80 -sV --script vulnOutput:
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
| http-enum:
| /wp-login.php: Wordpress login page
| /readme.html: Wordpress version: 2
| /: WordPress version: 5.3.4
| vulners:
| CVE-2019-0211 https://vulners.com/cve/CVE-2019-0211
| CVE-2018-1312 https://vulners.com/cve/CVE-2018-1312
| CVE-2017-15715 https://vulners.com/cve/CVE-2017-15715The scripts reveal web application versions and related CVEs.
More NSE scripts: Nmap NSE Documentation